Iranian government hackers hunting the political and civic activists

In past few weeks, different reports came out regarding hacking of Gmail accounts of Iranians inside the country. Sometimes even the two factor authentication method of Gmail were discussed. But maybe the most important reasons for these speculations in’t enough information about these attacks in the first place.

What is the story behind the recent attacks?

The recent attacks probably is one of the most sophisticated attacks ever happened. In these attacks, hackers with great deal of information about their target persons tried to hack their gmails accounts and in some cases they were successful, too.

This is obvious that this attacks are systematic and very well planned. Unlike traditional bulk attacks, the hackers tried to brake very systemically into different accounts of certain targets, including their gmail account.

Structure of recent attacks

Structure of these recent attacks is a mixture of Phishing and social engineering. After braking into the target’s email, they have sent emails with very precise literature the victim would use, including some personal details of the victim to their network of their close friends and colleagues in an attempt to hack their email accounts as well.

Lets review one of the used tactics: The hackers created a fake website, like human rights activist news or woman’s rights news, which they knew the victim will be attracted to. Then they would introduce the website from hacked account, as if the email account owner himself / herself would right with the same literature, and send them to other victims in the contact lists and asked them to click on the link and visit their new website and become a member.

Now, when the other parties would visit the website, they would see a page that let them login with their Facebook / Google / Yahoo or WindowsLive ID. Now, the attacker would receive their user and password to their email account. At the same time, the phishing website would send a real request to google to send the 2 factor authentication code to the victim’s phone. once the code is also entered to the phishing website, attackers would immediately login to their account and disable the 2 authentication factor login. Using the same method, the attackers managed to gain access to several email accounts.

When this attacks has been reviewed, it came to light that the hackers once gained access to the victim’s account, initiated correspondence with his / her close friends, using the same literature and language of the victim and also deleting the messages from SENT folder afterwards, and using the same method to hack other accounts.

One thing needs to be mentioned is that the victims of this system received the 2nd authentication code from Google by SMS, not the Google authenticator. From this mechanics it came to light that 2nd factor generated by google authenticator can not be used for a second time, but codes received via SMS can be used for multiple logins.

Considering the above, paying attention to 3 points can – almost – mitigate these types of attacks :

1. Google APP will never ask for a second factor authentication response: if you wanted to login to a 3rd party website with your google account, you should know google will never ask for a response and if you saw such a request you should know this is a phishing website.
2. Never open a website by a link in an email: Either search for the website in google or type the address manually. using this, you may avoid a large portion of phishing attacks.
3. Don’t use your main email address for 3rd party website memberships: for subscribing to newsletters and 3rd party memberships use a dedicated email address which you made for this purpose. This way, if your email is hacked, the attacker accessed a useless account and not your main email account.

Generally you should know there is no silver bullet in digital security and you can’t be 100% sure about your security. But you can make sure you to pay attention to digital security aspects as much as possible.

I published this article for the first time on the BBC Persian website and Project Anita translated into English.

If you would like to have conversation about this story, you can send an email to aminsabeti [at] gmail [dot] com or poke me @AminSabeti on Twitter.